3
5
Fork 0
mirror of git://git.savannah.gnu.org/guix.git synced 2023-12-14 03:33:07 +01:00
guix/gnu/packages/patches/p7zip-CVE-2017-17969.patch
Leo Famulari a630c64709
gnu: p7zip: Fix CVE-2017-17969.
* gnu/packages/patches/p7zip-CVE-2017-17969.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/compression.scm (p7zip)[source]: Use it.
2018-02-05 16:21:40 -05:00

35 lines
1.1 KiB
Diff

Fix CVE-2017-17969:
https://sourceforge.net/p/p7zip/bugs/204/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17969
Patch copied from Debian.
Subject: Heap-based buffer overflow in 7zip/Compress/ShrinkDecoder.cpp
Origin: vendor, https://sourceforge.net/p/p7zip/bugs/_discuss/thread/0920f369/27d7/attachment/CVE-2017-17969.patch
Forwarded: https://sourceforge.net/p/p7zip/bugs/_discuss/thread/0920f369/#27d7
Bug: https://sourceforge.net/p/p7zip/bugs/204/
Bug-Debian: https://bugs.debian.org/888297
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-17969
Author: Antoine Beaupré <anarcat@debian.org>
Reviewed-by: Salvatore Bonaccorso <carnil@debian.org>
Last-Update: 2018-02-01
Applied-Upstream: 18.00-beta
--- a/CPP/7zip/Compress/ShrinkDecoder.cpp
+++ b/CPP/7zip/Compress/ShrinkDecoder.cpp
@@ -121,8 +121,13 @@ HRESULT CDecoder::CodeReal(ISequentialIn
{
_stack[i++] = _suffixes[cur];
cur = _parents[cur];
+ if (cur >= kNumItems || i >= kNumItems)
+ break;
}
-
+
+ if (cur >= kNumItems || i >= kNumItems)
+ break;
+
_stack[i++] = (Byte)cur;
lastChar2 = (Byte)cur;